CVE-2022-3255

Name: CVE-2022-3255
Creator: NVD / NIST
Published: 2022-09-21T13:15:09.46+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.8/10EPSS 0.64%

Last modified Jun 17, 2026

CVE-2022-3255 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. EPSS estimates a 0.64% chance of exploitation in the next 30 days.

Description

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

Metrics

CVSS 3.1

4.8/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

0.64%

46.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Pimcore	Pimcore	< 10.5.7

References

https://github.com/pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201bPatch, Third Party Advisory
https://huntr.dev/bounties/0ea45cf9-b256-454c-9031-2435294c0902Exploit, Third Party Advisory
https://github.com/pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201bPatch, Third Party Advisory
https://huntr.dev/bounties/0ea45cf9-b256-454c-9031-2435294c0902Exploit, Third Party Advisory

Timeline

Published: Sep 21, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-3255?

How severe is CVE-2022-3255?

CVE-2022-3255 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 0.64% probability of exploitation in the next 30 days.

How do I fix CVE-2022-3255?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-3255?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST